WordPress · Report #221734

Administrator(s) Information disclosure via JSON on wordpress.org

N/Astatus

mediumseverity

4upvotes

19 Apr 2017disclosed

Summary

My only concern is already closed as informative and why you reopened and closed as N/A?, But its ok. its already done. no problem. Thank you and God bless @johnbillion.

How it was found

Greetings,

Hello Security Team,

Summary:

I have found a security vulnerability that can disclose some information of administrator users in this sub domain developer.wordpress.org

Description (Include Impact):

Sensitive information disclosure of administrator users.

PoC URL:

https://developer.wordpress.org/wp-json/wp/v2/users

PoC Screen Shot:

{F176692}

Let me know if you need more information.

Cheers! j3

This report was disclosed publicly on HackerOne and belongs to its author and the program. See the original